MFH: Fixed bug #34456 (Possible crash inside pspell extension).

1 files changed, 24 insertions, 12 deletions

diff --git a/ext/pspell/pspell.c b/ext/pspell/pspell.c
index 63e6d3e7be..8e9f5470a6 100644
--- a/ext/pspell/pspell.c
+++ b/ext/pspell/pspell.c
@@ -697,6 +697,7 @@ PHP_FUNCTION(pspell_config_runtogether)
 	zval **sccin, **runtogether;
 	int argc;
 
+	PspellManager *manager;
 	PspellConfig *config;
 	
 	argc = ZEND_NUM_ARGS();
@@ -705,12 +706,13 @@ PHP_FUNCTION(pspell_config_runtogether)
 	}
 
 	convert_to_long_ex(sccin);
-	config = (PspellConfig *) zend_list_find(Z_LVAL_PP(sccin), &type);
-	if(!config){
+	manager = (PspellManager *) zend_list_find(Z_LVAL_PP(sccin), &type);
+	if(!manager){
 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "%ld is not a PSPELL config index", Z_LVAL_PP(sccin));
 		RETURN_FALSE;
 	}
 
+	config = pspell_manager_config(manager);
 	convert_to_boolean_ex(runtogether);
 	pspell_config_replace(config, "run-together", Z_LVAL_PP(runtogether) ? "true" : "false");
 	
@@ -726,6 +728,7 @@ PHP_FUNCTION(pspell_config_mode)
 	zval **sccin, **mode;
 	int argc;
 
+	PspellManager *manager;
 	PspellConfig *config;
 	
 	argc = ZEND_NUM_ARGS();
@@ -734,12 +737,13 @@ PHP_FUNCTION(pspell_config_mode)
 	}
 
 	convert_to_long_ex(sccin);
-	config = (PspellConfig *) zend_list_find(Z_LVAL_PP(sccin), &type);
-	if(!config){
+	manager = (PspellManager *) zend_list_find(Z_LVAL_PP(sccin), &type);
+	if(!manager){
 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "%ld is not a PSPELL config index", Z_LVAL_PP(sccin));
 		RETURN_FALSE;
 	}
 
+	config = pspell_manager_config(manager);
 	convert_to_long_ex(mode);
 
 	/* First check what mode we want (how many suggestions) */
@@ -767,6 +771,7 @@ PHP_FUNCTION(pspell_config_ignore)
 	char ignore_str[PSPELL_LARGEST_WORD + 1];	
 	long ignore = 0L;
 
+	PspellManager *manager;
 	PspellConfig *config;
 	
 	argc = ZEND_NUM_ARGS();
@@ -775,12 +780,13 @@ PHP_FUNCTION(pspell_config_ignore)
 	}
 
 	convert_to_long_ex(sccin);
-	config = (PspellConfig *) zend_list_find(Z_LVAL_PP(sccin), &type);
-	if(!config){
+	manager = (PspellManager *) zend_list_find(Z_LVAL_PP(sccin), &type);
+	if(!manager){
 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "%ld is not a PSPELL config index", Z_LVAL_PP(sccin));
 		RETURN_FALSE;
 	}
 
+	config = pspell_manager_config(manager);
 	convert_to_long_ex(pignore);
 	ignore = Z_LVAL_PP(pignore);
 
@@ -810,6 +816,7 @@ static void pspell_config_path(INTERNAL_FUNCTION_PARAMETERS, char *option)
 	int type;
 	zval **sccin, **value;
 	int argc;
+	PspellManager *manager;
 	PspellConfig *config;
 	
 	argc = ZEND_NUM_ARGS();
@@ -818,12 +825,13 @@ static void pspell_config_path(INTERNAL_FUNCTION_PARAMETERS, char *option)
 	}
 
 	convert_to_long_ex(sccin);
-	config = (PspellConfig *) zend_list_find(Z_LVAL_PP(sccin), &type);
-	if (!config) {
+	manager = (PspellManager *) zend_list_find(Z_LVAL_PP(sccin), &type);
+	if (!manager) {
 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "%ld is not a PSPELL config index", Z_LVAL_PP(sccin));
 		RETURN_FALSE;
 	}
 
+	config = pspell_manager_config(manager);
 	convert_to_string_ex(value);
 
 	if (PG(safe_mode) && (!php_checkuid(Z_STRVAL_PP(value), NULL, CHECKUID_CHECK_FILE_AND_DIR))) {
@@ -871,6 +879,7 @@ PHP_FUNCTION(pspell_config_repl)
 	zval **sccin, **repl;
 	int argc;
 
+	PspellManager *manager;
 	PspellConfig *config;
 	
 	argc = ZEND_NUM_ARGS();
@@ -879,12 +888,13 @@ PHP_FUNCTION(pspell_config_repl)
 	}
 
 	convert_to_long_ex(sccin);
-	config = (PspellConfig *) zend_list_find(Z_LVAL_PP(sccin), &type);
-	if(!config){
+	manager = (PspellManager *) zend_list_find(Z_LVAL_PP(sccin), &type);
+	if(!manager){
 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "%ld is not a PSPELL config index", Z_LVAL_PP(sccin));
 		RETURN_FALSE;
 	}
 
+	config = pspell_manager_config(manager);
 	pspell_config_replace(config, "save-repl", "true");
 
 	convert_to_string_ex(repl);
@@ -911,6 +921,7 @@ PHP_FUNCTION(pspell_config_save_repl)
 	zval **sccin, **save;
 	int argc;
 
+	PspellManager *manager;
 	PspellConfig *config;
 	
 	argc = ZEND_NUM_ARGS();
@@ -919,12 +930,13 @@ PHP_FUNCTION(pspell_config_save_repl)
 	}
 
 	convert_to_long_ex(sccin);
-	config = (PspellConfig *) zend_list_find(Z_LVAL_PP(sccin), &type);
-	if(!config){
+	manager = (PspellManager *) zend_list_find(Z_LVAL_PP(sccin), &type);
+	if(!manager){
 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "%ld is not a PSPELL config index", Z_LVAL_PP(sccin));
 		RETURN_FALSE;
 	}
 
+	config = pspell_manager_config(manager);
 	convert_to_boolean_ex(save);
 	pspell_config_replace(config, "save-repl", Z_LVAL_PP(save) ? "true" : "false");